5 ms·

Regarding GDPR, citation needed - do you have actual links you can share to those claimed "recent interpretations", and whose in particular they are? I'd be qui

by akavel 4y ago

Regarding GDPR, citation needed - do you have actual links you can share to those claimed "recent interpretations", and whose in particular they are? I'd be quite interested to see them, if true ,which I seriously doubt - for the time being, as an EU citizen, my understanding is, and continues to be, that it's totally possible for US corpos to adhere to GDPR; it would just require some money and effort to be spent by companies that blatantly hoover and hoard personally identifying data in hopes of squeezing some monies from it. And having to spend some money on anything that is not an investment into more money in the future seems to always trigger over-the-top allergic reaction in corporations. Until they feel the teeth of real law in painful fines, when suddenly "impossible" things will magically become possible.

mminer237 4y ago
They're decisions by the governments of Germany, France, and Italy: * https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ * https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply https://www.cnil.fr/en/use-google-analytics-and-data-transfe... * https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9782890 https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... So far they've just been enforced against companies that use Google Analytics, but the reasoning behind it has been that having users connect to a US server enables that server to know EU users' IP addresses (which are legally PII), which would be subject to US government subpoenas to collect such, and the US government has not agreed to handle data in compliance with the GDPR, therefore it's illegal to have users connect to any US servers. It has nothing to do with "hoover[ing] and hoard[ing]" data. The only way for an American website to comply would be to form a separate company not subject to US control at all. However, at that point it's not really an American website, since no data or control can go to the US. Theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper, but I'm not aware of such a service at this time.
- akavel 4y ago
  Doesn't seem so clear cut to me yet, but I see what you're hinting at. The first one seems about Google Fonts specifically, together with IPs indeed, but not mentioning US govt subpoenas at all (at least in the English translation of the abstract). Personally, I long believed Google Fonts are a risk from privacy standpoint and not really necessary, just easy - this seems to basically be reflected in the abstract and makes me quite happy. Interestingly, it seems to mention severity of the privacy abuse potential vs. benefit, which again sounds great to me. Now, the 2nd one mentions GA and subpoenas, so this becomes more tricky and I wonder what will come of it. Though for the time being, GA is exactly a target I hoped would be regulated, so again rather happy for now, though I see how this seems indeed a concern dealing with any US company. And how connecting the two (i.e. IPs as PII + US govt subpoenas) becomes a concern as well. IANAL, obviously, though. But interesting, thanks!
- calvinmorrison 4y ago
  I don't really think being a good 'worldwide' business can exist when longterm there are conflicting views held by governments about what is right. The fact is some governments and societies values are objectively better than others
- jhgb 4y ago
  How does any of those things make it "essentially impossible for any US-owned or US-hosted site to comply with GDPR"? Is it legally required in the US, for example, to use Google Analytics?
  - mminer237 4y ago
    No, but that's irrelevant. It's illegal for an American to host a home server with EU visitors for the same reason it's illegal for them to use AWS or Google Analytics. A GDPR-compliant website can't embed Google Analytics or Google Fonts or a US-hosted image because then the host could log those IP addresses and the host could be subject to a US warrant. Likewise, a GDPR-compliant site can't be operated or hosted by an American because then the operator/host could be logging visitor IP addresses and be subject to a warrant and be compelled to give the government the evidence.
KptMarchewa 4y ago
US cloud act makes it impossible for any US company to both collect any personal data and be fully compliant with GDPR.

by akavel 4y ago

mminer237 4y ago

They're decisions by the governments of Germany, France, and Italy: * https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ * https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply https://www.cnil.fr/en/use-google-analytics-and-data-transfe... * https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9782890 https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... So far they've just been enforced against companies that use Google Analytics, but the reasoning behind it has been that having users connect to a US server enables that server to know EU users' IP addresses (which are legally PII), which would be subject to US government subpoenas to collect such, and the US government has not agreed to handle data in compliance with the GDPR, therefore it's illegal to have users connect to any US servers. It has nothing to do with "hoover[ing] and hoard[ing]" data. The only way for an American website to comply would be to form a separate company not subject to US control at all. However, at that point it's not really an American website, since no data or control can go to the US. Theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper, but I'm not aware of such a service at this time.

akavel 4y ago
Doesn't seem so clear cut to me yet, but I see what you're hinting at. The first one seems about Google Fonts specifically, together with IPs indeed, but not mentioning US govt subpoenas at all (at least in the English translation of the abstract). Personally, I long believed Google Fonts are a risk from privacy standpoint and not really necessary, just easy - this seems to basically be reflected in the abstract and makes me quite happy. Interestingly, it seems to mention severity of the privacy abuse potential vs. benefit, which again sounds great to me. Now, the 2nd one mentions GA and subpoenas, so this becomes more tricky and I wonder what will come of it. Though for the time being, GA is exactly a target I hoped would be regulated, so again rather happy for now, though I see how this seems indeed a concern dealing with any US company. And how connecting the two (i.e. IPs as PII + US govt subpoenas) becomes a concern as well. IANAL, obviously, though. But interesting, thanks!
calvinmorrison 4y ago
I don't really think being a good 'worldwide' business can exist when longterm there are conflicting views held by governments about what is right. The fact is some governments and societies values are objectively better than others
jhgb 4y ago
How does any of those things make it "essentially impossible for any US-owned or US-hosted site to comply with GDPR"? Is it legally required in the US, for example, to use Google Analytics?
- mminer237 4y ago
  No, but that's irrelevant. It's illegal for an American to host a home server with EU visitors for the same reason it's illegal for them to use AWS or Google Analytics. A GDPR-compliant website can't embed Google Analytics or Google Fonts or a US-hosted image because then the host could log those IP addresses and the host could be subject to a US warrant. Likewise, a GDPR-compliant site can't be operated or hosted by an American because then the operator/host could be logging visitor IP addresses and be subject to a warrant and be compelled to give the government the evidence.

KptMarchewa 4y ago

US cloud act makes it impossible for any US company to both collect any personal data and be fully compliant with GDPR.